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Abstract 

— Counterfactuals  are  a  form  of  coinmonsense  non  monotonic  inference  that  has  been  of 
long-term  interest  to  philosophers.  In  this  paper  ,  we 1>egin^>y  describing  some  of  the  impact 
counterfactuals  can  be  expected  to  have  in  artificial  intelligence,  and  by  reviewing  briefly 
some  of  the  philosophical  conclusions  which  have  been  drawn  about  them.  Philosophers 
have  noted  that  the  content  of  any  particular  countcrfactual  is  in  part  context-dependent; 
we  present  a  formal  description  of  counterfactuals  that  allows  us  to  encode  this  context- 
dependent  information  clearly  in  the  choice  of  a  sublanguage  of  the  logical  language  in 
which  we  are  working.  Having  made  this  choice,  we  show  that  our  description  of  coun¬ 
terfactuals  is  formally  identical  to  the  accepted"^) ossible  worlds"*  interpretation  due  to 
David  Lewis.  Finally,  we  examine  the  application  of  our  ideas  in  the  domain  of  automated 
diagnosis  of  hardware  faults. 

§1.  Introduction^  J  / 


A  counterfactual  is  a  statement  such  as,  “if  p,  then  g,"  where  p  is  expected  to  be  false. 
Typical  examples  are,  “If  the  electricity  hadn’t  failed,  dinner  would  have  been  ready  on 
time,”  or  “If  the  bedroom  door  were  open,  I  could  get  the  widget  I  left  in  there.” 

From  the  point  of  view  of  logical  semantics,  counterfactuals  are  always  true.  This  is 
in  contrast  with  our  intuitive  understanding  of  their  content,  which  might  well  accept  the 
statements  in  the  last  paragraph  while  rejecting,  for  example,  “If  the  power  hadn’t  failed, 
pigs  would  fly." 

Indeed,  the  distinction  between  true  and  false  counterfactuals  seems  to  undcrly  much 
of  our  use  of  knowledge.  When  planning  the  solution  to  a  complicated  problem,  we  reduce 
it  to  subproblcms  by  realising  that  we  can  prove  a  countcrfactual  of  the  form,  “If  only  thus- 
and-so  were  true,  I  would  be  able  to  solve  the  original  problem.”  The  original  problem 
reduces  to  proving  the  countcrfactual  (in  some  suitable  sense)  and  to  arranging  for  thus- 
and-so  to  be  true. 

Consider  the  problem  of  crossing  a  river  if  the  only  boat  available  has  no  oars.  The 
countcrfactual,  “If  I  had  some  oars,  I’d  be  able  to  cross  the  river,”  suggests  replacing  the 
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original  problem  with  that  of  finding  something  with  which  to  row.  This  is  a  fairly  general  tlW 
phenomenon:  counterfactuals  suggest  goal  regressions. 
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Counterfactuals  also  enable  os  to  understand  why  plans  fail.  The  example  we  have 
already  mentioned,  “If  the  electricity  hadn’t  failed,  dinner  would  have  been  ready  on  time,” 
is  typical.  The  electricity  did  fail.  But  in  spite  of  its  lack  of  logical  content,  the  statement 
docs  explain  why  the  soup  isn’t  ready. 

Dave  Smith  has  pointed  out  that  additional  applications  can  be  found  in  the  area 
of  design.  Suppose  that  a  machine  contains  an  on-line  representation  of  the  design  of  a 
complex  device.  Questions  of  the  form,  "If  I  were  to  remove  the  pullup  resistor  connected 
to  the  output  of  the  or  gate,  would  the  output  of  the  circuit  change?”  are  counterfactual 
in  nature. 

Diagnosis  is  similar.  The  counterfactual,  "If  the  device  fails  in  this  fashion,  the  and 
gate  is  not  functioning,”  allows  us  to  reason  directly  from  the  intended  description  of  the 
design  of  the  device  in  question,  as  opposed  to  reasoning  from  a  description  that  explicitly 
allows  for  the  failure  of  some  component,  as  in  [4].  The  nature  of  counterfactual  implication 

is  also  such  as  to  subsume  the  single  fault  assumption — the  above  counterfactual  will  be 
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true  if  (and  only  if)  a  fault  in  the  and  gate  is  sufficient,  in  and  of  itself,  to  explain  the 
failure  of  the  device. 

Finally,  counterfactuals  will  necessarily  play  a  part  in  natural  language  understanding. 
The  extent  to  which  they  pervade  our  communications  makes  it  inevitable  that  we  will 
eventually  need  a  formal  description  of  them. 

My  aim  in  this  paper  is  twofold.  Firstly,  I  would  like  to  describe  briefly  some  of  the 
existing  philosophical  work  that  has  been  done  on  counterfactuals,  although  with  an  eye 
toward  eventual  applications  in  artificial  intelligence.  Secondly,  I  will  present  a  formal 
description  of  counlcrfacluals  that  is  precise  enough  to  admit  a  machine  implementation. 

Before  proceeding,  though,  I  should  point  out  that  there  arc  other  types  of  conditionals 
of  potential  interest  in  artificial  intelligence.  An  indicative  conditional  is  a  statement  of 
the  form,  “If  x  is  a  bird,  then  z  can  fly.”  There  is  some  consensus  among  philosophers 
[1,5]  that  the  truth  value  of  such  a  conditional  is  probabilistic;  the  reason  philosophers 
draw  a  distinction  between  indicative  conditionals  and  other  probabilistic  statements  is 


because  our  confidence  in  “If  x  is  a  bird,  then  x  can  fly”  is  a  function  of  the  likelihood  of  a 
randomly  selected  bird  flying,  as  opposed  to  the  likelihood  of  the  statement  being  true  for 
a  randomly  selected  instantiation  of  x.  The  statement  will  be  true  for  the  overwhelming 
majority  of  such  instantiations,  since  most  of  them  will  not  be  birds. 

I  will  not  be  concerned  with  indicative  conditionals  here.  They  have  already  been 
considered  extensively  in  the  non-monotonic  literature  [7]. 

There  is  also  a  very  loose  connection  between  counterfactuals  and  causality.  In  the 
planning  examples  we  have  given,  the  counterfactual  “if  p,  then  9”  corresponds  to  “->p  is 
a  cause  for  -19.”  The  electricity  failure  is  the  cause  of  the  lateness  of  the  dinner.  The  lack 
of  oars  prevents  us  from  crossing  the  river. 

This  connection  cannot  be  pushed  too  far,  however.  Suppose  that  after  a  MYCIN 
run,  we  want  to  know  why  the  machine  asked  that  a  certain  clinical  test  be  taken.  The 
response  is  that,  “If  the  result  had  been  positive,  the  organism  would  have  been  rodlike.” 
This  is  a  useful  counterfactual,  but  the  causal  connection  is  from  the  conclusion  to  the 
premise,  as  opposed  to  the  reverse. 

An  example  where  there  is  no  causal  connection  at  all  can  be  found  in  [6].  Suppose 
that  Olga  attends  a  certain  party,  but  that  Boris,  who  is  trying  to  avoid  Olga,  does  not. 
If  Olga  has  no  similar  aversion  to  Boris,  we  would  have  that,  “(Even)  if  Boris  had  come, 
Olga  would  (still)  have  come.”  Here,  the  counterfactual  describes  the  lack  of  a  causal 
connection. 

§2.  Properties  of  counterfactuals 

In  his  excellent  book  on  counterfactuals,  Lewis  [C]  clarifies  the  distinction  between 
counterfactuals  and  standard  logical  implications  by  listing  some  of  the  properties  that 
distinguish  them.  The  results  of  this  section  arc  not  new,  but  may  be  unfamiliar  to  an  AI 
audience.  A  fairly  complete  treatment  of  this  topic  can  also  be  found  in  [9]. 

Contraposition  is  not  a  valid  rule  of  inference  for  counterfactuals.  If  we  denote  the 
counterfactual,  “if  p,  then  9,”  by  p  >  9,  we  cannot  conclude  -*9  >  ->p  from  p  >  9.  Returning 
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to  out  power  failure  example,  it  may  well  be  the  case  that  if  the  power  hadn't  failed,  dinner 
would  have  been  on  time: 

The  power  didn’t  fail  >  dinner  was  on  time. 

It  does  not  follow  from  this  that  the  electricity  would  have  failed  if  dinner  had  been  late — 
there  may  well  be  an  alternative  possible  cause. 

Counterfactuals  are  not  necessarily  transitive.  From  p  >  q  and  q  >  r  we  cannot 
necessarily  conclude  p>  r.  The  standard  example  is  due  to  Stalnaker  [10]: 

If  J.  Edgar  Hoover  had  been  born  a  Russian,  then  he  would  have  been  a  Communist, 

and 

If  he  had  been  a  Communist,  he  would  have  been  a  traitor 
do  not  together  imply 

If  Hoover  had  been  born  a  Russian,  he  would  have  been  a  traitor. 
finally,  eounterfactuals  are  non-monotonic.  Rrota  p  >  r  we  cannot  necessarily  con¬ 
clude  p  A q  >  r.  In  fact,  it  is  possible  to  have  p  >  r  and  pAq>  -w:  The  two  statements, 
“If  the  electricity  hadn't  failed,  dinner  would  have  been  ready  on  time,"  and  “If  the  elec¬ 
tricity  hadn't  failed,  but  I  had  been  elected  president,  dinner  would  have  been  late,"  are 
completely  consistent. 

Glymour  and  Thomason  [5]  seem  to  infer  from  this  last  observation  that  the  study  of 
non-monotonic  inference  generally  can  be  subsumed  to  some  extent  under  an  investigation 
of  eounterfactuals,  but  in  light  of  the  breadth  of  the  non-monotonic  nature  of  commonsense 
reasoning  (the  frame  problem,  indicative  conditionals,  etc.),  this  seems  to  me  to  miss  the 
mark.  Coiinlcrfaclunls  in  fact  seem  to  be  a  distinct  type  of  noii-moiiotonic  reasoning. 

§3.  Possible  worlds 

Following  an  idea  of  Stalnaker’s  (10],  most  modern  investigations  of  eounterfactuals 
are  based  on  the  notion  of  possible  worlds.  Loosely  speaking,  we  analyse  a  counlcrfactual 
P>  q  by  considering  the  "possible  world"  that  is  as  similar  to  our  (real)  world  as  possible, 
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given  that  p  is  true  in  it.  The  counterfactual  is  true  or  not  depending  upon  whether  or 
not  q  holds  in  this  world. 

Lewis  [6]  has  observed  that  this  “most  similar  possible  world”  may  s  *  be  unique.  He 
defines  a  counterfactual  to  be  true  if  and  only  if  it  holds  uniformly  in  the  most  similar 
possible  worlds  in  which  the  premise  holds. 

This  distinction  is  apparent  if  we  consider  the  law  of  the  counterfactual  excluded 
middle: 

(p>q)v(p>  ->q). 

In  Stalnaker’s  view,  either  q  or  ->q  will  hold  in  the  nearest  possible  world  where  p  holds, 
so  that  the  disjunction  above  will  be  valid.  Lewis  points  out  that  this  may  not  be  the  case 
by  examining  the  counterfactuals,  “If  Bizet  and  Verdi  had  been  compatriots,  Bizet  would 
have  been  Italian,”  and,  “If  Bizet  and  Verdi  had  been  compatriots,  Bizet  would  not  have 
been  Italian.”  Both  of  these  appear  to  be  invalid. 

It  is  possible  to  upderstand  the  discussion  of  section  2  in  terms  of  possible  worlds; 
we  will  discuss  only  the  non-monotonic  nature  of  counterfactuals  here.  The  other  two 
properties  described  earlier  are  similar. 

The  basic  reason  that  p  >  r  and  p  A  q  >  ->r  axe  consistent  is  that  worlds  where  p  A  q 
hold  may  be  much  less  similar  to  our  own  than  worlds  where  p  alone  holds.  It  is  entirely 
possible  that  r  holds  uniformly  in  the  nearest  of  the  p-worlds  while  -ir  holds  uniformly  in 
the  (more  distant)  nearest  of  the  p  A  ^-worlds.  It  is  also  possible  that  r  holds  in  some  of 
the  nearest  of  the  p  A  ^-worlds  while  ->r  holds  in  others.  In  this  case  we  would  have  only 
p>  r  and  -> (p A q  >  r). 

Returning  to  our  power  failure  example,  the  nearest  possible  worlds  in  which  the 
power  remained  on  arc  worlds  in  which  dinner  was  ready  on  time.  In  the  nearest  of  the 
(much)  more  distant  worlds  where  I  was  elected  president,  dinner  was  late.  In  still  more 
distant  worlds,  such  as  those  where  the  power  remained  on  and  I  was  elected  president, 
but  no  one  bothered  to  inform  me,  dinner  will  once  again  be  prompt. 

We  can  formalize  these  notions  by  assuming  that,  given  a  fixed  world  F,  the  set  of  all 


possible  worlds  Wa  can  be  ordered  under  a  relation  >p  where  U  >f  V  if  U  is  at  least  as 
similar  to  F  as  V  is.  We  can  also  define  >*•  a sU  >pV  iff  -»(V  >f  U)\  here  U  is  more 
similar  to  F  than  V  is. 

Lewis  now  defines  a  counterfactual  p  >  q  to  be  trite  in  some  world  F  if  there  exists  a 
world  U  such  that: 

(1)  p  is  true  in  17,  and 

(2)  pD  q  is  true  in  any  world  V  with  V  >p  U  (i.e.,  if  V  if  any  world  as  similar  to  F  as 

U  is,  q  will  hold  in  V  if  p  does). 

He  also  defines  p  >  q  to  be  (vacuously)  true  if  there  is  no  possible  world  U  in  which  p 
holds. 

The  following  diagram  of  his  may  help  to  explain  this.  The  concentric  circles  around 
F  each  contain  worlds  of  equal  similarity  to  F.  The  diagram  on  the  left  corresponds  to 
the  case  where  q  holds  uniformly  in  the  most  similar  of  the  p  worlds  (the  shaded  region 
in  the  diagram),  so  that  p  >  q  is  valid.  In  the  righthand  diagram,  neither  q  nor  ~>q  holds 
uniformly  in  these  worlds,  so  that  Neither  p  >  q  not  p  >  -q  is  valid. 


P><!  ~(p>q) 


$4.  Framework 

From  an  AI  perspective,  the  difficulty  with  the  possible  worlds  interpretation  of  coun- 
terfactuals  is  that  the  notion  of  "similarity”  is  too  vaguely  defined.  Our  main  intention  in 


this  paper  is  to  present  a  sharper  definition  of  it. 


Intuitively,  there  are  (at  least)  three  measures  of  the  similarity,  or  lack  thereof,  between 
different  possible  worlds.  These  correspond  loosely  to  the  number  of  propositions  whose 
truth  values  change,  to  the  extent  by  which  these  truth  values  change,  and  to  the  relative 
importance  of  the  propositions  involved. 

The  last  of  these  is  the  most  difficult  to  understand  in  any  formal  sense,  since  (as  we 
will  see  in  the  next  section)  it  is  fundamentally  dependent  upon  context.  In  fact,  we  will  be 
able  to  do  little  more  than  to  provide  a  way  to  encode  information  concerning  the  relative 
importance  of  the  propositions  being  considered.  It  is  of  some  interest  to  note  that  the 
scheme  we  will  present  can  be  used  to  define  a  notion  of  similarity  that  is  unchanged  from 
one  possible  world  to  another;  in  other  words,  we  can  impose  some  sort  of  uniformity  on 
the  various  relations  >f  presented  in  the  last  section. 

The  other  two  sources  of  similarity  are  more  syntactic.  If  the  truth  value  of  a  propo¬ 
sition  changes  unnecessarily,  in  the  sense  that  the  possible  world  without  the  change  is 
consistent,  the  possible  world  which  incorporates  the  change  should  be  deemed  “more  dis¬ 
tant”  from  our  own  than  the  one  which  doesn’t.  Similarly,  a  world  where  the  truth  value 
of  some  fixed  proposition  changes  from  “true”  to  “true  by  default”  is  closer  than  one  where 
the  truth  value  changes  from  “true”  to  “false”. 

Although  this  latter  is  not  a  feature  that  will  arise  in  a  simple  predicate  calculus  inter¬ 
pretation  of  counterfacluals,  it  is  important  to  us  because  much  commonsensc  reasoning 
seems  to  involve  these  “intermediate”  truth  values.  Since  countcrfactuals  are  aspects  of 
commonsensc  reasoning,  they  will  need  to  mesh  neatly  with  the  features  of  other  common- 
sense  systems. 

In  order  to  allow  for  this,  we  will  work  in  a  logical  system  that  is  as  loosely  defined 
as  possible.  While  looking  for  a  logical  system  that  potentially  includes  predicate  calculus 
and  some  form  of  dcfault/probabilistic  reasoning  as  special  cases,  we  must  also  find  one 
capable  of  supporting  precise  notions  corresponding  to  logical  ideas  such  as  closure  and 
consistency,  since  these  ideas  undcrly  that  of  counterfactual  implication.  The  construction 
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we  are  about  to  present  will  in  fact  be  a  generalisation  of  one  due  to  Ellis  [2]. 

Fix  a  partially  ordered  set  T  of  truth  values,  and  assume  that  T  admits  a  least  upper 
bound  operation.  Denote  by  u  (“unknown”)  the  least  upper  bound  of  all  of  the  elements 
of  T.  Next,  let  L  be  the  set  of  sentences  in  sarnie  language.  We  define  a  truth  function  to 
be  a  mapping 

4>:L  —*T. 

Intuitively,  <f>(p)  <  <p(q)  if  we  are  more  certain  of  the  truth  or  falsity  of  p  than  of  q. 

Predicate  calculus  corresponds  to  T  =  (t= true,  /=false)  with  u  >  t  and 

u  >  f\  t  and  /  are  incomparable.  A  truth  function  <f>  assigns  to  each  sentence  of  L  its 
truth  value,  if  one  is  known  (and  tt  otherwise). 

We  will  say  that  a  truth  function  <f>  is  an  extension  of  a  truth  function  ip,  writing 
<p  <  ip,  it  <p{p)  <  ip(p)  for  all  p  €  L.  We  will  call  an  extension  <f>  proper  if  the  inequality  is 
strict  for  at  least  one  p  in  L,  and  will  call  ^  a  simple  extension  if  <p(p)  /  ip(p)  for  only  a 
single  p  €  L. 

We  will  also  assume  that  we  have  some  way  of  determining  whether  or  not  a  truth 
function  is  consistent.  In  the  predicate  calculus  case  upon  which  we  are  modelling  our 
analysis,  however,  the  truth  value  of  a  compound  sentence  is  defined  recursively  in  terms 
of  the  truth  values  of  its  components;  furthermore,  the  definition  only  applies  if  the  truth 
values  of  these  components  are  t  or  /  (as  opposed  to  u).  The  (consistent)  assignment  of 
the  truth  values  t  or  /  to  all  of  the  sentences  in  L  constitutes  a  model  for  L. 

In  general,  a  model  can  be  characterised  by  the  fact  that  it  is  impossible  to  add  to 
the  information  corresponding  to  the  truth  assignments  of  the  model.  Since  we  have  been 
interpreting  r  <  a  (for  truth  values  r  and  s)  to  mean  that  the  information  content  of  the 
truth  value  r  is  greater  than  that  of  s,  it  follows  that  it  will  be  impossible  to  supplement 
the  information  content  of  the  truth  assignment  <f>(p)  if  <p(p)  is  a  minimal  element  of  T. 

This  leads  us  to  define  a  truth  function  ^  to  be  a  model  if  <p(p)  is  minimal  for  all  p  €  L. 
If  a  truth  function  ip  is  a  model  that  is  an  extension  of  the  truth  function  <p,  we  will  say 
that  ip  is  a  modular  extension  of  <p.  Assuming  that  consistency  is  defined  ns  a  primitive 


for  models,  we  will  say  that  a  truth  function  <f>  is  consistent  iff  <p  has  a  consistent  modular 
extension. 

Here  are  some  predicate  calculus  examples.  In  the  first  two  cases,  ip  is  a  consistent 
modular  extension  of  <p.  Since  <p  in  the  third  case  has  no  consistent  modular  extension,  it 
is  inconsistent. 
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Lemma  1.  Let  k  be  the  set  ot  consistent  truth  functions.  Then  if  <p  <  ip  and  <p  €  k, 
ip€n. 

Proof.  Since  tp  <  ip,  any  extension  of  ^  is  an  extension  of  ip.  □ 

Equivalently,  any  extension  of  an  inconsistent  truth  function  will  also  be  inconsistent. 

We  might  model  default  logic  with  X  =  {u,t,/,dt,c(f,pt,p/,  *},  with  eft  =  “true  by 
default”,  df  —  “false  by  default”,  pt= “propensity  for  truth”  and  pf = “propensity  for  falsity” . 
Now 

dt  =  lub(t,/,pt)  =  lub(t,pt) 
df  =  lub(f,/,p/)  =  lub(/,p/) 
u  =  lub(t,/,p*,p/)  =  lub(pf,p/) 

*  =  lub(t, /). 

Probabilistic  logic  might  correspond  to  T  =  {[a,  6]  C  [0,1]},  with  [a,  6]  <  [c,<f]  if  [a,b]  C 
[c,<f].  The  minimal  elements  of  T  in  this  case  arc  the  singletons  {x}  C  [0, 1]. 

For  a  consistent  truth  function  <P,  the  closure  of  <p  will  be  the  least  upper  bound  of 
the  consistent  modular  extensions  of  <p ,  and  will  be  denoted  cl(^).  If  <p  =  cl(^>),  <p  will  be 
called  closed.  It  is  not  hard  to  see  that  this  corresponds  to  logical  closure  in  the  predicate 
calculus  case. 


In  the  example  below,  <P\  and  fa  are  the  only  consistent  modular  extensions  of  <p: 


<t>l  fa  Cl(^) 


Lemma  2.  cl{<f>)  <  <f>. 

Proof.  Let  {</><}  be  the  consistent  modular  extensions  of  <f>.  Then  <f>i  <  <f>  for  all  t,  so  that 
cl(^)  =  lub{&}  <  <f>.  □ 

Related  to  the  notion  of  closure  is  that  of  reduction:  a  truth  function  <f>  will  be  called 
reduced  if  all  of  its  simple  extensions  are  consistent.  The  idea  is  that  a  simple  extension 
of  <f>  corresponds  to  the  acquisition  of  more  knowledge  about  some  specific  proposition;  if 
every  such  extension  is  consistent,  the  original  truth  function  must  have  been  minimal  in 
the  sense  that  it  had  no  extensions  which  were  ‘'necessary”  consequences  of  it. 

That  the  notions  of  closed  and  reduced  truth  functions  are  not  identical  is  demon¬ 
strated  by  the  following  example:  Returning  to  the  case  where  T  is  the  set  of  closed 
subintervals  of  [0,  l],  suppose  that  there  is  a  proposition  p  such  that  <f>(p)  =  0  is  not  con¬ 
sistent,  but  such  that  <f>(p)  =  *  is  consistent  for  every  x  /  0.  Now  a  truth  function  with 
<)>{p)  =  (0,1]  may  well  be  closed,  since  [0,1]  =  lub{z  €  (0,1]}.  It  will  not  be  reduced, 
however,  since  the  simple  extension  given  by  <f>(p)  =  0  is  inconsistent. 

In  order  to  formalise  the  connection  between  reduction  and  closure,  we  need  the 
following  definition:  The  consistency  set  k  will  be  called  dense  if,  for  all  collections  of 
truth  functions  which  agree  uniformly  except  on  a  single  sentence  p  €  L,  if  G  * 

for  all  *,  V'i(p)  is  minimal  for  all  t,  and  4>{p)  <  ltib{V>*(p) } >  then  <j>  €  k.  Intuitively,  if  k  is 
dense  and  llic  V>,  arc  consistent  and  agree  except  at  a  single  proposition  p,  then  if  <f>  is  any 
truth  function  that  agrees  with  them  except  at  p,  and  such  that  4>{p)  is  in  the  “span”  of 
the  ifri  (p) ,  then  <j>  will  be  consistent  as  well. 

Lemma  3.  Predicate  calculus  is  dense. 

Proof.  If  4>(p)  <  lub {V>i(p)}  and  each  V'i(p)  is  cither  t  or  /,  we  must  have  <f>(p)  >  rpi(p) 


i 


,  w  *  ,  ' 


*r  ■  ur.  it 


.  -  *■_ 


for  some  t.  Now  apply  lemma  1.  □ 


Lemma  4.  Suppose  k  is  dense.  Then  any  closed  truth  function  $  is  reduced. 


Proof.  Let  ^  be  a  simple  extension  of  <f>  with  tj>[p)  V'(p)-  Then  there  exist  consistent 
modular  extensions  0,  of  <t>  with  t}>{p)  <  lub{0,(p)}.  Define  truth  functions  0(  by 


g'(a\  _  /  ^(?)»  9  ^  P 

*{9)~U(9),  *9  =  P- 


Since  0,  is  an  extension  of  0',  the  0'  are  consistent,  agree  with  i/>  except  at  p,  and  V’(p)  < 
lub{0'(p)}.  Therefore  ^  is  consistent.  □ 


§5.  Similarity 


The  terminology  introduced  in  the  last  section  allows  us  to  make  precise  some  of  the 
ideas  in  section  3:  possible  worlds  correspond  to  consistent  models,  and  sets  of  possible 
worlds  to  consistent  truth  functions. 

The  difficulty  with  this  is  that  we  still  lack  a  formal  notion  of  similarity.  Part  of  the 
problem  is  context-dependent,  as  we  can  see  from  the  pair  of  counterfactuals 

If  Caesar  had  been  in  command  (in  Korea J,  he  would  have  used  the  atom  bomb 

and 

If  Caesar  had  been  in  command,  he  would  have  used  catapults. 

This  example  is  Quine’s  [8].  Either  countcrfactual  may  well  be  true  (although  not  both); 
if  the  first,  Caesar’s  character  is  important  to  our  notion  of  similarity;  if  the  second,  it  is 
the  tools  he  had  available  which  are  relevant. 

It  is  clearly  impossible  to  select  between  these  two  counterfactuals  in  advance;  the  best 
wc  can  do  is  to  present  a  method  for  encoding  in  our  semantic  machinery  the  information 
leading  to  the  choice.  In  order  to  do  this,  let  V  be  a  subset  of  L,  and  suppose  that  ^  is  a 
fixed  truth  function  defined  on  L  —  L'.  We  can  now  define  a  truth  function  i>  on  V  to  be 
consistent  if  and  only  if  the  truth  function 


for  p  6  V , 
for  p<$-  L' 
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is  consistent.  The  effect  of  this  is  to  fix  the  truth  values  outside  of  X',  so  that  any  consistent 
truth  function  on  V  must  be  consistent  with  them. 


In  the  above  example,  if  V  includes  “Caesar  was  a  ruthless  military  leader,”  but  not, 
“Caesar’s  military  tools  were  those  of  the  Roman  Empire  at  its  height,”  we  will  have  to 
accept  Caesar’s  use  of  catapults  without  question,  regardless  of  the  weapons  available  at 
the  time  of  the  engagement,  resulting  in  the  validity  of  the  counterfactual  which  concludes 
that  he  would  have  used  catapults.  If  the  situation  were  reversed,  the  other  counterfactual 
would  be  valid.  If  L'  includes  both  of  the  statements  describing  Caesar,  the  construction 
we  will  present  will  ambiguously  select  either  of  the  counterfactuals,  while  if  both  of  the 
descriptions  are  relegated  to  X,  both  counterfactuals  will  be  vacuously  true  because  no 
truth  function  <f>  with  ^(Caesar  in  command)  =  t  will  have  a  consistent  extension  to  all  of 
X. 

Given  the  choice  of  a  (possibly  restricted)  language  X',  let  p  be  a  sentence  in  X', 

4>  a  truth  function,  and  a  a  truth  value.  We  will  investigate  the  consequences  of  the 

% 

counterfactual  premise  <f>(p)  =  a  be  defining  a  new  truth  function,  to  be  denoted  ^|*(p)=,, 
and  corresponding  to  <f>  with  the  truth  value  at  p  replaced  by  a.  If  a  =  t,  so  that  we  are 
interested  in  restricting  the  value  of  <f>(p)  to  “true”,  we  will  denote  4>\+(p)*t  simply  by  4>\p. 

Wc  will  follow  the  Caesarian  example  carefully  throughout  this  section.  We  have  the 
following  propositions  in  X': 

K  =  Caesar  in  command  in  Korea 

r  =  Caesar  was  ruthless 

R  =  Caesar’s  tools  were  those  of  the  Romans 

a  =  the  atom  bomb  was  used  in  Korea 

c  =  catapults  were  used  in  Korea. 

In  X  are  the  rules  of  inference: 


K Ar  — » a 


The  last  of  these  is  equivalent  to  ~>{K  A  r  A  R).  Our  initial  troth  assignment  is  given  by: 
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Of  interest  to  os  is  the  truth  function  4\k\  what  if  Caesar  had  been  in  command  in  Korea? 

The  general  difficulty  is  that  simply  changing  4>{p)  to  a  may  well  produce  an  incon¬ 
sistent  truth  function.  We  begin  therefore  by  replacing  4>(p)  not  with  a,  but  with  the 
least  upper  bound  of  a  and  4>(p)-  This  truth  function  <f>'  must  be  consistent  (since  ^  is  an 
extension  of  it),  but  need  not  be  closed. 


* 

4? 

cm 

K 

f 

u  =  lub{t,f) 

f 

r 

t 

t 

t 

R 

t 

t 

t 

a 

f 

f 

f 

c 

f 

f 

f 

Assume  next  that  there  is  at  least  one  reduced  truth  function  iff  of  which  is  an 
extension.  (By  lemma  3,  we  will  generally  be  able  to  take  for  ^  the  least  upper  bound  of 
all  consistent  models  for  L.)  The  set  of  all  such  rp'a  is  partially  ordered  under  extension; 
let  4>"  be  a  minimal  element  of  it. 
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The  result  of  replacing  ^"(p)  with  a  is  necessarily  consistent,  since  4>"  is  reduced  and 
4>n{v\  >  a  initiallv.  Let  0  be  the  truth  function  obtained  bv  niakine  this  renlaeement.  and 
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The  construction  we  have  given  works  through  the  construction  of  the  “intermediate" 
truth  function  4>" ,  which  is  in  some  sense  a  set  of  the  most  similar  possible  worlds  in  which 
we  might  have  4>{p)  being  either  its  original  value  or  the  new  value  s.  The  reason  we  have 
done  this  is  because  it  seems  to  be  technically  easier  to  define  similarity  for  a  world  of 
which  ours  is  an  extension  (<t>'  in  the  above  construction)  than  for  one  which  is  not  directly 
comparable  with  it  (as  <f>  with  <f>(p)  replaced  by  *  would  be). 

Having  constructed  similar  worlds  where  4>ip)  —  •  might  hold,  it  is  straightforward 
to  investigate  the  consequences  if  we  assume  that  it  does  hold.  This  is  the  content  of  our 
taking  to  be  the  closure  of  4>"  with  4>"{p)  replaced  by  s. 

The  choice  of  truth  function  4>"  corresponds  to  choosing  a  subset  of  the  possible  worlds 
in  which  ^(p)  =  s.  In  our  military  example,  assuming  Caesar  to  be  in  command  in  Korea 
required  our  abandoning  one  of  these  descriptions,  and  the  choice  of  which  to  discard 
corresponded  to  our  choice  of  dM* 

An  alternative  would  be  to  assume  that  the  worlds  where  we  abandon  one  description 
are  just  as  similar  to  our  own  as  those  in  which  we  abandon  another.  Lewis  might  well 
make  this  choice;  it  corresponds  to  defining 

Hp  >  9)  = 

where  the  least  upper  bound  is  taken  over  all  possible  choices  of  4". 

§6.  Formal  description 

Previous  analyses  of  countcrfactuals  have  generally  developed  a  set  of  axioms  which 
countcrfactual  implication  must  satisfy.  We  will  conclude  by  showing  that  our  definition 
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matches  Lewis’  in  the  predicate  calculus  case  and  with  the  definition  of  4>(p  >  q )  at  the 
end  of  the  last  section. 

Lewis  introduces  two  counterfactual  operators.  He  writes  p  □— *  q  for,  “If  it  were  the 
case  that  p,  then  it  would  be  the  case  that  g”,  and  p  0— *■  q  for,  “If  it  were  the  case  that  p, 
then  it  might  be  the  case  that  q.n  Both  of  these  are  handled  by  our  formalism.  We  write 

p  D-»  9  iff  ^(p  >  9)  =  * 

p$-+q  iff  ^(p  >  fl)  >  <• 

Theorem  5.  p  □-»  q  is  equivalent  to  ->(p  ~q). 

Proof.  Suppose  p  □— » q.  Then  if  ^  is  a  consistent  modular  extension  of  any  0  in  our 
counterfactual  construction  with  V'(p)  =  *>  f  Thus  i/>(-<q)  =  /,  so  ^(p  >  ~^q)  =  / 

and  ->(p  -*9).  The  reverse  implication  is  identical.  □ 

Lewis  in  fact  takes  CH  as  primitive  and  uses  theorem  5  to  define  0-*  . 

Our  main  result  depends  on  one  due  to  Gabrdenfors  [3]: 

Theorem  6  (Gardenfors).  A  counterfactual  operator  CH  is  formally  identically  to 
Lewis’  iff  it  satisfies: 


(p O— ♦  9)  A  (pO-»  r)  -*  (pD-»  9  Ar) 

(1) 

pCH  T 

(2) 

(pD-*  9)A  N  (9  -»  r)  -»  (p  r) 

(3) 

P  D— *  P 

(<) 

\=  (P  ~  9)  -*  ((P  D-»  r)  -4  (9  □-»  r)) 

(5) 

(p  A9)  —  (po-»  9) 

(6) 

(p  9)  _  (p  _  q) 

m 

(p  Q-»  r)  A  (q  D-»  r)  -*  (p  V  9  D-*  r) 

(8) 

(p  □— *  9)  A  -'(p  O— ♦  t)  “♦  (p  A  r  □— »  q).  0 

(9) 

15 


Theorem  7.  The  counterfactual  construction  of  section  5  is  formally  identical  to  Lewis’ 
possible  worlds  construction. 

Proof.  We  need  to  verify  (1)  through  (9)  above.  As  in  the  proof  of  theorem  5,  let  ^  be  a 
consistent  modular  extension  of  some  0  in  the  counterfactual  construction.  Then: 

For  (1),  we  must  show  that  if  V’(p)  —  t  implies  if>(q)  =  t  and  t/»(r)  =  t,  it  implies 
ip(q  A  r)  =  t.  This  is  immediate. 

For  (2),  we  must  show  that  V’CO  =  t.  This  is  also  immediate. 

For  (3),  we  must  show  that  if  t/>(p)  =  t  implies  if>(q)  =  t,  and  if  x{Q  —*  r)  =  t  for  any 
consistent  model  x>  then  V’(p)  =  t  implies  ip[r)  =  t. 

(4)  requires  that  if  t/>(p)  =  t,  then  V>(p)  =  t.  For  (5),  if  V’(p)  =  t  is  equivalent  to 
if>{q)  =  t,  then  clearly  rj>(p)  —  t  will  imply  =  t  iff  if>(q)  =  t  does. 

In  (6),  suppose  that  (p  A  q)  holds  for  our  original  truth  function  tf>-  Then  we  will 
clearly  have  <f>\p  =  <f>,  so  that  p  D-+  q  because  $(q)  =  t. 

For  (7),  if  <f>{p  -»  q)  /  t,  there  is  a  consistent  modular  extension  x  of  ^  with  x(p)  =  < 
and  x(?)  —  /•  This  x  will  also  be  a  consistent  modular  extension  of  a  0  in  the  counterfactual 
construction,  so  that  <f>(p  >  q)  £  t. 

The  only  non-trivial  case  in  (8)  is  that  where  ^(p)  =  ^(q)  =  /.  Now  the  premise 
is  equivalent  to  the  assumption  that  in  any  consistent  modular  extension  x  °f  9  where 
x(p)  =  t  or  x(9)  =  t,  X(r )  =  t.  Thus  if  x(p  V  q)  =  t,  x(0  =  t. 

In  (9),  suppose  first  that  4>(p)  =  t.  Then  we  know  that  $(q)  =  t,  and  ^(r)  >  t.  It 
follows  that  there  is  a  consistent  modular  extension  x  of  ^  with  x(pAr)  =  t,  so  that  <f>\p/\r 
is  an  extension  of  4>,  and  ^|,(Ar(q)  <  4>{q)  —  <■  4>{p)  =  ti  is  similar,  and  if  <f>(p)  =  /,  we  have 
that  there  is  a  consistent  modular  extension  x  of  some  0  with  x{pAr)  =  t,  and  that  for  any 
consistent  modular  extension  of  a  0  with  x(p)  =  ft  x(?)  =  * •  The  conclusion  follows.  o 

$7.  Example:  diagnosis 

7.1  Sotting 

Gencscreth  has  proposed  [4]  that  it  is  possible  for  machines  to  be  used  in  automated 


A  full  adder  is  essentially  a  one  bit  adder  with  carry  in  and  carry  out,  and  it  is 
usually  used  as  one  of  n  elements  in  an  n  bit  adder.  A  graphical  representation 
of  its  design  is  given  [above].  It  has  three  inputs  and  two  outputs  and  consists  of 
two  “xor”  gates  (XI  and  X2),  two  "and*  gates  (A1  and  A2),  and  an  “or"  gate 
(Ol)  ...  In  normal  operation,  the  first  output  (the  “sum”  line)  is  “on”  if  and 
only  if  an  odd  number  of  inputs  is  “on”;  the  second  output  (the  "carry”  line)  is 
“on”  if  and  only  if  at  least  two  inputs  are  “on”.  [4] 

Genesereth  proceeds  to  describe  the  design  of  the  full  adder  in  a  variant  of  prefix 

predicate  calculus.  We  continue  to  quote  him: 

8D1 :  (XORG  XI) 

SD2:  (XORG  X2) 

SD3:  (ANDG  Al) 

8D4:  (ANDG  A2) 

80S:  (ORG  01) 

806:  (CONK  (IN  1  FI)  (IN  1  Xl)) 

807:  (CONN  (IN  1  Fl)  (IN  1  Al)) 

808:  (CONN  (IN  2  Fl)  (IN  2  XI)) 

800:  (CONN  (IN  2  Fl)  (IN  2  Al)) 

8010:  (CONN  (IN  3  Fl)  (IN  2  X2)) 

8011:  (CONN  (IN  3  Fl)  (IN  1  A2)) 

8012:  (CONN  (OUT  1  XI)  (IN  1  X2)) 

8013:  (CONN  (OUT  1  XI)  (IN  2  A2)) 

8014:  (CONN  (OUT  1  Al)  (IN  2  01)) 


8D1S:  (COMM  (OUT  1  A2)  (IM  1  01)) 

8D16:  (COMM  (OUT  1  X2)  (OUT  1  PI)) 

SD17:  (COMM  (OUT  1  01)  (OUT  2  PI)) 

These  axioms  describe  the  structural  description  of  the  foil  adder.  SDl,  for  example,  states 
that  XI  is  an  exclusive- or  gate.  SD13  states  that  the  first  output  of  XI  is  connected  to 
the  second  input  of  A2. 

Genesereth  also  states  in  a  similar  form  results  describing  the  behavior  of  the  various 
sorts  of  gates,  and  describing  in  these  terms  what  it  means  for  two  points  in  the  circuit  to 
be  connected.  Using  these  additional  axioms,  it  is  possible  to  prove  that  if,  for  example, 
the  first  input  to  the  full  adder  is  on  while  the  other  two  are  off,  the  first  output  should 
be  on  while  the  second  should  be  off. 

7.2  Diagnosis  using  predicate  calculus 

The  situation  of  interest,  of  course,  is  that  in  which  the  outputs  of  the  adder  are  not 

as  predicted  by  the  design.  Genesereth  sssnmss  that  we  have: 

AC1:  (YAL  (it  1  PI)  1.0M) 

AC2:  (YAL  (IM  2  PI)  1  OPP) 

ACS:  (YAL  (IM  3  PI)  1  OPP) 

OBI:  (YAL  (OUT  1  PI)  1  OPP) 

0B2:  (VAL  (OUT  2  PI)  1  OPP) 

In  other  words,  the  values  of  the  three  inputs  to  the  adder  at  time  t  =  1  are  as  described 
at  the  end  of  the  last  subsection,  but  both  of  the  outputs  are  off  at  that  time. 

The  observed  behavior  characterised  by  AC  1- ACS  and  OB1-OB2  is  inconsistent  with 
the  design  given  by  SD1-SD17.  Diagnoeis  is  a  matter  of  resolving  this  inconsistency. 

To  do  so  using  predicate  calculus,  Genesereth  assumes  (correctly!)  that  the  device  in 
question  docs  not  satisfy  the  design  description  given  earlier,  but  instead  satisfies  some 
weaker  "device  assumptions".  In  the  example  we  are  considering,  he  assumes  that: 

(1)  The  connections  are  all  as  described  in  the  design,  and 

(2)  At  most  one  of  the  gates  is  broken  (the  single  fault  assumption). 

These  device  assumptions  can  be  written  as: 

DAI:  (COMM  (IM  1  PI)  (IN  1  XI)) 


DA2:  (CONN  (IN  1  FI)  (IN  1  Al)) 

DA3:  (CONN  (IN  2  FI)  (IN  2  XI)) 

DA4:  (CONN  (IN  2  FI)  (IN  2  Al)) 

DAS:  (CONN  (IN  3  FI)  (IN  2  X2)) 

DA6:  (CONN  (IN  3  FI)  (IN  1  A2)) 

DA7 :  (CONN  (OUT  1  XI)  (IN  1  X2)) 

DA8:  (CONN  (OUT  1  XI)  (IN  2  A2)) 

DA9:  (CONN  (OUT  1  Al)  (IN  2  01)) 

DA10:  (CONN  (OUT  1  A2)  (IN  1  01)) 

DA11:  (CONN  (OUT  1  X2)  (OUT  1  FI)) 

DA12:  (CONN  (OUT  1  01)  (OUT  2  FI)) 

DA13:  (IF  (NOT  (XORG  XI))  (AND  (XORC  X2)  (ANDG  Al)  (ANDG  A2)  (ORG  01))) 

DA14:  (IF  (NOT  (XORG  X2))  (AND  (XORG  XI)  (ANDG  Al)  (ANDG  A2)  (ORG  01))) 

DAIS:  (IF  (NOT  (ANDG  Al))  (AND  (XORG  Xi)  (XORG  X2)  (ANDG  A2)  (ORG  01))) 

DA16:  (IF  (NOT  (ANDG  A2))  (AND  (XORG  XI)  (XORG  X2)  (ANDG  Al)  (ORG  01))) 

DA17:  (IF  (NOT  (ORG  01))  (AND  (XORG  XI)  (XORG  X2)  (ANDG  Al)  (ANDG  A2))) 

The  reappearance  of  the  connection  information  in  DA1-DA12  amounts  to  the  assumption 
that  the  connections  are  intact;  the  axioms  DA13-DA17  encode  the  single  fault  assumption. 

The  axioms  above  are  consistent  with  the  observed  behavior  of  the  adder,  and. lead 
to  the  conclusions  that 


(OR  (NOT  (XORG  Xl))  (NOT  (XORG  X2)))  (10) 


and 

(AND  (ANDG  Al)  (ANDG  A2)  (ORG  Ol).  (11) 

In  other  words,  one  of  the  exclusive-or  gates  is  broken,  and  the  remaining  components  are 
functioning  satisfactorily.  The  information  about  the  functionality  of  the  and  and  or  gates 
is  useful  because  it  enables  us  to  generate  a  test  to  determine  which  of  the  two  exclusive-or 
gates  is  in  fact  faulty. 

The  difficulty  with  this  approach  is  that  it  requires  us  to  generate  the  device  as¬ 
sumptions  DA  1-DA  17.  It  is  possible  that  the  fault(s)  in  the  device  are  such  that  these 
assumptions  are  invalid,  in  which  case  the  system  will  be  unable  to  diagnose  the  device 
without  a  replacement  set  of  device  assumptions. 


7.3  Diagnosis  using  counterfactuals 

The  device  assumptions  in  the  last  subsection  were  introduced  to  encode  our  belief  that 
the  wiring  in  the  adder  was  correct,  and  to  enable  us  to  take  advantage  of  the  simplifying 
assumption  that  only  one  of  the  remaining  components  was  damaged.  Both  of  these 
conditions  can  be  recast  naturally  in  the  framework  of  counterfactuals . 

To  perform  the  diagnosis  using  the  methods  we  have  presented,  we  will  assume  the 
structural  description  DS1-DS17  and  the  inputs  achieved  by  AC1-AC3,  and  examine  the 
counterfactual  consequences  of  the  observed  outputs  OB1-OB2.  There  are  three  possible 
explanations  for  the  fault: 

(1)  One  or  more  of  the  components  is  faulty. 

(2)  The  wiring  is  faulty. 

(3)  The  inputs  were  not  as  expected. 

We  eliminate  all  but  the  first  from  our  counterfactual  reasoning  by  including  only  the 
component  assumptions  SD1-SD5  in  our  restricted  language  V .  The  wiring  and  input 
assumptions  SD6-SD17  and  AC1-AC3  are  therefore  assumed  to  be  independent  of  the 
counterfactual  assumptions  corresponding  to  the  observed  misbehavior  of  the  device. 

The  conclusion  (10)  that  one  of  the  two  exclusivc-or  gates  must  be  faulty  is  in  fact  a 
logical  consequence  of  the  behavior  of  the  device: 

OBI  A  OB2  (OB  (NOT  (XORG  Xi))  (NOT  (XORG  X2))). 

Meanwhile,  because  the  remaining  components  cannot  be  contributing  to  the  observed 
fault,  their  continued  performance  is  counter/actually  implied  by  the  observed  behavior: 

0131  A  OB2  >  (AND  (ANDG  Al)  (ANDG  A2)  (ORG  01)). 

This  reappearance  of  (11)  is  especially  useful.  Because  of  the  non-monotonic  nature 
of  counterfactual  reasoning,  it  is  of  course  possible  that  additional  observations  appended 
to  the  lefthand  side  of  the  above  equation  will  invalidate  its  conclusion;  this  will  hap¬ 
pen  whenever  the  single  fault  assumption  is  violated.  In  this  case,  however,  rather  than 


generating  a  contradiction,  the  connterfactual  analysis  will  automatically  produce  a  new 
diagnosis  which  once  again  involves  failure  for  a  minimal  set  of  components. 

It  is  possible,  however,  for  a  counterfactual  analysis  to  suggest  a  violation  of  the  single 
fault  assumption  when  one  is  not  required.  If  the  observed  behavior  can  be  explained  either 
by  the  failure  of  a  single  component,  or  by  the  failure  of  a  pair  of  different  components, 
both  will  be  proposed.  There  is  nothing  counterintuitive  about  this,  however — it  is  quite 
normal  to  assume  that  a  group  of  normally  undependable  components  has  failed  before 
questioning  a  single  part  of  proven  reliability.  In  any  event,  we  can  if  necessary  retain  the 
single  fault  assumption  by  using  it  to  select  among  the  possible  4>"’a  in  the  counterfactual 
construction  itself. 

§8.  Conclusion 

Our  aim  in  this  paper  has  been  to  present  a  formal  description  of  counterfactuals, 
describing  them  in  terms  of  existing  logical  operators  instead  of  following  the  usual  practice 
of  developing  a  “counterfactual  calculus”  to  describe  their  behavior. 

We  have  also  sought  to  work  in  a  setting  that  will  not  eventually  commit  us  to  any 
particular  reasoning  paradigm;  since  counterfactuals  are  a  form  of  commonsense  reasoning, 
and  there  are  currently  a  variety  of  competing  paradigms  for  commonsense  reasoning 
generally,  this  seemed  prudent. 

The  construction  we  have  presented  seems  to  meet  these  objectives.  It  has  indeed 
described  counterfactuals  in  terms  of  existing  logical  primitives,  and,  in  the  setting  of 
predicate  calculus,  reduces  to  the  “possible  worlds”  interpretation  of  counterfactuals  that 
is  accepted  by  philosophers. 

Our  construction  also  distinguishes  clearly  between  the  context  dependent  and  context 
independent  features  of  counterfactual  implication.  It  provides  us  with  a  precise  method 
for  selecting  those  aspects  of  our  world  which  are  to  be  considered  inviolable  even  under 
a  counterfactual  assumption;  having  made  such  a  choice,  we  proceed  to  generate  possible 
worlds  which  respect  it. 
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The  biggest  difficulty  with  the  approach  we  have  described  is  the  rather  heavy-handed 
nature  of  the  choice  described  in  the  last  paragraph.  Although  it  is  possible  to  clearly 
recognise  ambiguities  remaining  in  the  analysis  of  any  particular  counterfactual  (they 
correspond  to  the  choice  of  <f>"  in  our  construction),  we  have  no  method  for  choosing 
consistently  between  them.  In  any  specific  implementation,  it  will  of  course  be  possible  to 
select  an  <f>"  when  one  is  needed,  but  we  have  not  considered  the  nature  of  the  formalism 
that  should  govern  this  choice. 
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